Inheritable Smart Contract Wallet

Summary

The Inheritable Smart Contract Wallet is intended to provide a time-locked inheritance management system where assets are distributed to designated beneficiaries after a period of wallet inactivity (standard: 90 days). The contract also supports minting NFTs representing real-life assets for on-chain settlements. However, a critical vulnerability related to external contract interaction via call{}() has been identified, which may allow unauthorized access to funds through reentrancy attacks.

Vulnerability Details

The contract allows external contract interaction via call{}(), which is noted as potentially dangerous despite having reentrancy guards. The current implementation of these guards is insufficient under specific conditions, making the contract vulnerable to reentrancy attacks.

Exploit Scenario:

• An attacker deploys a malicious contract that triggers the call{}() function in a recursive manner.

• Improper handling of state updates before external calls allows the attacker to re-enter the contract’s functions, bypassing the intended reentrancy protection.

• Unauthorized access to funds can occur before or during the inheritance process.

Proof of Concept (PoC):

• Deploy a malicious contract designed to exploit the external call mechanism.

• Trigger the recursive calls during inheritance processing or fund withdrawal by beneficiaries.

• Observe how the intended state is altered, leading to unauthorized access to funds.

Impact

This vulnerability has a high impact, potentially leading to:

• Unauthorized access to inheritance funds.

• Manipulation of the inheritance process.

• Complete drainage of the contract’s funds via recursive calls.

Tools Used

• Manual Code Review

• Remix IDE for Simulation

• Foundry & Hardhat Testing Environment

Recommendations

1. Review and Strengthen Reentrancy Guards: Ensure state-changing operations are completed before external calls.

2. Implement Pull-Payment Pattern: Replace direct calls with a pull-payment mechanism to reduce reentrancy risks.

3. External Contract Validation: Introduce stricter validation mechanisms for external contract interactions.

Thank you for your consideration.